CVE-2024-22873

Опубликовано: 26 фев. 2024

Источник: nvd

CVSS3: 8.1

EPSS Низкий

Описание

Tencent Blueking CMDB v3.2.x to v3.9.x was discovered to contain a Server-Side Request Forgery (SSRF) via the event subscription function (/service/subscription.go). This vulnerability allows attackers to access internal requests via a crafted POST request.

Ссылки

http://blueking.com
Product
http://tencent.com
Product
https://gist.github.com/exp1orer/0f190c6a64b668a9b1c4c47789affa09
Third Party Advisory
https://sphenoid-enquiry-9be.notion.site/BK-CMDB-SSRF-ba21e94f4976460188fa52d26c15a6ae?pvs=4
Exploit
http://blueking.com
Product
http://tencent.com
Product
https://gist.github.com/exp1orer/0f190c6a64b668a9b1c4c47789affa09
Third Party Advisory
https://sphenoid-enquiry-9be.notion.site/BK-CMDB-SSRF-ba21e94f4976460188fa52d26c15a6ae?pvs=4
Exploit

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:tencent:blueking_configuration_management_database:*:*:*:*:*:*:*:*

Версия от 3.2.2 (включая) до 3.9.47 (включая)

EPSS

Процентиль: 41%

0.00189

Низкий

8.1 High

CVSS3

Дефекты

CWE-918

Связанные уязвимости

GHSA-5m9g-hh42-2p58